Imagine buying a 'cold storage' wallet to keep your crypto safe from hackers, only to find out the device itself was spying on you. For some Ledger users, that nightmare just became a reality. In a chilling example of a supply-chain attack, Ledger has confirmed that some of its devices were tampered with before they ever reached the customer.
The Anatomy of the Implant
This wasn't a software bug or a phishing scam; it was a physical breach. Ledger's Donjon security team discovered unauthorized hardware implants—essentially spy chips—inside devices sold by a Southeast Asian reseller called CryptoBilis.
These implants were sophisticated. They featured eSIM and LTE modules that allowed the device to connect to a mobile network. The chip reportedly read the user's seed phrase directly off the screen and beamed it wirelessly to the attackers. Once the hackers had those words, the 'cold' storage became an open door, leading to an estimated $90 million in drained funds.
A Warning on Third-Party Sellers
This breach highlights a critical vulnerability in the crypto ecosystem: the supply chain. While Ledger's internal security remains intact, the journey from the factory to the user is where the risk lies. By purchasing from an unauthorized reseller like CryptoBilis, users bypassed the secure chain of custody, leaving their devices open to physical tampering.
Ledger has since paused sales through the reseller and is reviewing how its devices reach buyers to prevent this from happening again.
Sources
Media
